CVE-2014-4692
pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Published
2014-07-02T10:35:26.033
Last Modified
2025-04-12T10:46:40.837
Status
Deferred
Source
[email protected]
Severity
CVSSv2: 4.3 (MEDIUM)
CVSSv2 Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
- Access Vector: NETWORK
- Access Complexity: MEDIUM
- Authentication: NONE
- Confidentiality Impact: PARTIAL
- Integrity Impact: NONE
- Availability Impact: NONE
Exploitability Score
8.6
Impact Score
2.9
Weaknesses
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
netgate
|
pfsense
|
≤ 2.1.3 |
Yes
|
References